Dire Wolf Ransomware Comes Out Snarling, Bites Technology, Manufacturing

Trustwave SpiderLabs analyzed a newly emergent ransomware group dubbed "Dire Wolf" that has impacted 16 organizations across 11 countries; the actor uses double extortion with targeted, victim-tailored encryptors and a monthlong payment window, publishes proof-of-exfiltration on a leak site, and provides live-chat credentials to negotiate ransoms. The sample analyzed was a UPX-packed Golang binary that enforces a single-instance mutex (Global\direwolfAppMutex), disables Windows event logging and recovery features, terminates interfering processes/services, and encrypts files using Curve25519 and ChaCha20 while appending a .direwolf extension; defenders are advised to harden endpoints, patch critical vulnerabilities, and deploy detections for the observed defense-evasion and impact techniques.